bazarbackdoor | 5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244

Analysis

Target
5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe
Size 344KB
Sample201011-klpkhlb2ce
SHA256 5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244
MD5 37b8839337f2e3c2c33363340de34cbe
SHA1 0ec6f3f662bd4542673d08b7615e61e9b51500f1
SHA512 408ab622ed55fe5566f7eff907165f39447e738584d1bfa32e85a23769763c816c62fc2d9d7d8aebf5a5eb37fa7aab93d32c87e1a04164ed852fe680369d18b8
MD5 SHA1 SHA512

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

BazarBackdoor 2 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

description	flow	ioc
HTTP URL	18	https://burngs.com/0185399226586446720460696334006414135278/2
HTTP URL	18	https://burngs.com/0185399226586446720460696334006414135278/4

Bazar/Team9 Loader payload 4 IoCs

resource	yara_rule
behavioral2/memory/2784-0-0x0000000001E90000-0x0000000001EAF000-memory.dmp	BazarLoaderVar1
behavioral2/memory/2784-1-0x0000000180000000-0x000000018001D000-memory.dmp	BazarLoaderVar1
behavioral2/memory/2080-2-0x00007FF796020000-0x00007FF796041000-memory.dmp	BazarLoaderVar1
behavioral2/memory/2080-3-0x00007FF796022210-mapping.dmp	BazarLoaderVar1

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	2080	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe
2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76
PID 2784 wrote to memory of 2080	2784	5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe	76

C:\Users\Admin\AppData\Local\Temp\5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe
"C:\Users\Admin\AppData\Local\Temp\5c59f12280cdfd8303296be2502e5800873fe8dd7aa800bddd18da475f787244.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Blocklisted process makes network request
  PID:2080

memory/2080-2-0x00007FF796020000-0x00007FF796041000-memory.dmp

Download

memory/2784-0-0x0000000001E90000-0x0000000001EAF000-memory.dmp

Download

memory/2784-1-0x0000000180000000-0x000000018001D000-memory.dmp

Download